@adammcarter/use-cases 0.1.0

package/packages/core/dist/markers/cli/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./io.js";
+export * from "./shared.js";
+export * from "./scan.js";
+export * from "./bind.js";
+export * from "./prove.js";
+export * from "./verify.js";
+export * from "./validateLedger.js";
+export * from "./precommit.js";
+//# sourceMappingURL=index.d.ts.map

package/packages/core/dist/markers/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/markers/cli/index.ts"],"names":[],"mappings":"AAKA,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AAEpC,cAAc,gBAAgB,CAAC"}

package/packages/core/dist/markers/cli/index.js

@@ -0,0 +1,15 @@
+// Phase 7 CLI command cores: bind / scan / prove / validate-ledger.
+//
+// Pure-ish command functions taking injectable fs/git/clock/verification-runner,
+// so they are unit-testable against a tmp dir without shelling out. The thin
+// cli wiring parses argv, resolves a workspace context, and calls these.
+export * from "./io.js";
+export * from "./shared.js";
+export * from "./scan.js";
+export * from "./bind.js";
+export * from "./prove.js";
+export * from "./verify.js";
+export * from "./validateLedger.js";
+// Phase 8: precommit orchestrator + PR-summary formatter (pure, unit-tested).
+export * from "./precommit.js";
+//# sourceMappingURL=index.js.map

package/packages/core/dist/markers/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/markers/cli/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,yEAAyE;AACzE,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,8EAA8E;AAC9E,cAAc,gBAAgB,CAAC"}

package/packages/core/dist/markers/cli/io.d.ts

@@ -0,0 +1,18 @@
+export interface MarkerDirEntry {
+    name: string;
+    isDirectory: boolean;
+    isFile: boolean;
+    isSymlink: boolean;
+}
+export interface MarkerWriteOptions {
+    preserveMode?: boolean;
+}
+export interface MarkerFs {
+    readText(path: string): string | null;
+    writeText(path: string, text: string, options?: MarkerWriteOptions): void;
+    exists(path: string): boolean;
+    listDir(path: string): MarkerDirEntry[];
+}
+export declare const nodeMarkerFs: MarkerFs;
+export declare function appendJsonlLine(fs: MarkerFs, path: string, line: string): void;
+//# sourceMappingURL=io.d.ts.map

package/packages/core/dist/markers/cli/io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../../src/markers/cli/io.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IAKjC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAEtC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAAC;CACzC;AAED,eAAO,MAAM,YAAY,EAAE,QAyC1B,CAAC;AAKF,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI9E"}

package/packages/core/dist/markers/cli/io.js

@@ -0,0 +1,62 @@
+// Injectable filesystem seam for the Phase 7 CLI command cores.
+//
+// The command logic (bind/scan/prove/validate-ledger) is kept pure-ish by routing
+// every filesystem touch through `MarkerFs`. The default implementation uses
+// node:fs and is what the thin cli wiring passes; tests run the same default
+// against a throwaway tmp dir (or substitute their own seam). Keeping this narrow
+// means the command cores never import node:fs directly.
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+export const nodeMarkerFs = {
+    readText(path) {
+        try {
+            return readFileSync(path, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return null;
+            }
+            throw error;
+        }
+    },
+    writeText(path, text, options) {
+        mkdirSync(dirname(path), { recursive: true });
+        let preservedMode;
+        if (options?.preserveMode) {
+            try {
+                preservedMode = statSync(path).mode;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    throw error;
+                }
+            }
+        }
+        const tempPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+        writeFileSync(tempPath, text);
+        if (preservedMode !== undefined) {
+            chmodSync(tempPath, preservedMode);
+        }
+        renameSync(tempPath, path);
+    },
+    exists(path) {
+        return existsSync(path);
+    },
+    listDir(path) {
+        return readdirSync(path, { withFileTypes: true }).map((entry) => ({
+            name: entry.name,
+            isDirectory: entry.isDirectory(),
+            isFile: entry.isFile(),
+            isSymlink: entry.isSymbolicLink()
+        }));
+    }
+};
+// Append a single JSONL line to a ledger file, tolerating an absent file and a
+// missing trailing newline on the existing content. Append-only by construction:
+// existing bytes are never rewritten, only extended.
+export function appendJsonlLine(fs, path, line) {
+    const existing = fs.readText(path) ?? "";
+    const base = existing === "" || existing.endsWith("\n") ? existing : `${existing}\n`;
+    fs.writeText(path, `${base}${line}\n`);
+}
+//# sourceMappingURL=io.js.map

package/packages/core/dist/markers/cli/io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.js","sourceRoot":"","sources":["../../../src/markers/cli/io.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,6EAA6E;AAC7E,kFAAkF;AAClF,yDAAyD;AACzD,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,QAAQ,EACR,aAAa,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0BpC,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,SAAS,CAAC,IAAY,EAAE,IAAY,EAAE,OAA4B;QAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,aAAiC,CAAC;QACtC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACnD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5D,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrC,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,CAAC,IAAY;QACjB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,IAAY;QAClB,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;YACtB,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE;SAClC,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC;AAEF,+EAA+E;AAC/E,iFAAiF;AACjF,qDAAqD;AACrD,MAAM,UAAU,eAAe,CAAC,EAAY,EAAE,IAAY,EAAE,IAAY;IACtE,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC;IACrF,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC;AACzC,CAAC"}

package/packages/core/dist/markers/cli/precommit.d.ts

@@ -0,0 +1,32 @@
+import type { FreshnessRowOut, FreshnessStatus } from "../freshness.js";
+import type { ScanCommandResult } from "./scan.js";
+import type { ValidateLedgerCommandResult } from "./validateLedger.js";
+export type PrecommitDecision = "BLOCK" | "WARN" | "OK";
+export interface PrecommitBlockReason {
+    source: "validate-ledger" | "scan";
+    code: string;
+    row_id?: string;
+    message: string;
+}
+export interface PrecommitWarning {
+    row_id: string;
+    status: "SUSPECT" | "UNPROVEN" | "UNBOUND";
+    reason: string;
+    required_action: string;
+    message: string;
+}
+export interface PrecommitResult {
+    decision: PrecommitDecision;
+    exit_code: number;
+    block_reasons: PrecommitBlockReason[];
+    warnings: PrecommitWarning[];
+    messages: string[];
+}
+export interface PrecommitInput {
+    validateLedger: Pick<ValidateLedgerCommandResult, "ok" | "exit_code" | "evidence_valid" | "registry_valid" | "append_only" | "errors">;
+    scan: Pick<ScanCommandResult, "exit_code" | "registry_valid" | "evidence_valid" | "status">;
+}
+export declare function formatPrecommitWarning(row: FreshnessRowOut): PrecommitWarning;
+export declare function decidePrecommit(input: PrecommitInput): PrecommitResult;
+export declare function formatFreshnessPrSummary(status: FreshnessStatus): string;
+//# sourceMappingURL=precommit.d.ts.map

package/packages/core/dist/markers/cli/precommit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"precommit.d.ts","sourceRoot":"","sources":["../../../src/markers/cli/precommit.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAEvE,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IAExB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,iBAAiB,CAAC;IAE5B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAG7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAKD,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,IAAI,CAClB,2BAA2B,EAC3B,IAAI,GAAG,WAAW,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,aAAa,GAAG,QAAQ,CACpF,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,QAAQ,CAAC,CAAC;CAC7F;AAmBD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,CAgB7E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAkGtE;AAOD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAsDxE"}

package/packages/core/dist/markers/cli/precommit.js

@@ -0,0 +1,174 @@
+const WARN_STATUSES = new Set(["SUSPECT", "UNPROVEN", "UNBOUND"]);
+function firstReasonCode(row) {
+    return row.reasons[0]?.code ?? row.status;
+}
+function defaultRequiredAction(row) {
+    if (row.required_action) {
+        return row.required_action;
+    }
+    return row.status === "UNBOUND"
+        ? `uc bind --row ${row.row_id}`
+        : `uc prove --row ${row.row_id}`;
+}
+// Build the loud warning block exactly as spec 10.1 mandates for SUSPECT (the
+// status word and reason vary by row).
+export function formatPrecommitWarning(row) {
+    const reason = firstReasonCode(row);
+    const requiredAction = defaultRequiredAction(row);
+    const message = [
+        `USE-CASE ROW ${row.status}`,
+        `row: ${row.row_id}`,
+        `reason: ${reason}`,
+        `required action: ${requiredAction}`
+    ].join("\n");
+    return {
+        row_id: row.row_id,
+        status: row.status,
+        reason,
+        required_action: requiredAction,
+        message
+    };
+}
+export function decidePrecommit(input) {
+    const blockReasons = [];
+    const warnings = [];
+    // --- validate-ledger: any failure blocks (spec 10.1 items 6-10). ---
+    if (!input.validateLedger.ok) {
+        if (input.validateLedger.errors.length > 0) {
+            for (const error of input.validateLedger.errors) {
+                blockReasons.push({
+                    source: "validate-ledger",
+                    code: error.code,
+                    message: `validate-ledger (${error.scope}): ${error.message}`
+                });
+            }
+        }
+        else {
+            blockReasons.push({
+                source: "validate-ledger",
+                code: "LEDGER_INVALID",
+                message: "validate-ledger reported the evidence ledger or binding registry as invalid"
+            });
+        }
+    }
+    // --- scan: ledger/registry validation failures (exit 4) block too. ---
+    if (!input.scan.registry_valid || !input.scan.evidence_valid) {
+        const ledgerIntegrity = input.scan.status.integrity_errors.filter((error) => error.row_id === undefined);
+        if (ledgerIntegrity.length > 0) {
+            for (const error of ledgerIntegrity) {
+                blockReasons.push({
+                    source: "scan",
+                    code: error.code,
+                    message: `scan ledger/registry: ${error.message ?? error.code}`
+                });
+            }
+        }
+        else {
+            blockReasons.push({
+                source: "scan",
+                code: "LEDGER_INVALID",
+                message: "scan reported the evidence ledger or binding registry as invalid"
+            });
+        }
+    }
+    // --- scan: usage/config/internal error (exit 2) blocks. ---
+    if (input.scan.exit_code === 2) {
+        blockReasons.push({
+            source: "scan",
+            code: "SCAN_USAGE_ERROR",
+            message: "scan failed with a usage/config/internal error (exit 2)"
+        });
+    }
+    // --- per-row: INVALID blocks; policy-blocked rows block; warn statuses warn. ---
+    for (const row of input.scan.status.rows) {
+        if (row.status === "INVALID") {
+            blockReasons.push({
+                source: "scan",
+                code: firstReasonCode(row),
+                row_id: row.row_id,
+                message: `INVALID row ${row.row_id}: ${firstReasonCode(row)}`
+            });
+            continue;
+        }
+        if (row.policy_block) {
+            // A non-INVALID row the policy blocks: in release mode, a required row that
+            // is not FRESH (spec 10.2). Surfaced as a block, not a soft warning.
+            blockReasons.push({
+                source: "scan",
+                code: "FRESHNESS_POLICY_BLOCK",
+                row_id: row.row_id,
+                message: `freshness policy blocks ${row.row_id} (status ${row.status}); ` +
+                    `${defaultRequiredAction(row)}`
+            });
+            continue;
+        }
+        if (WARN_STATUSES.has(row.status)) {
+            warnings.push(formatPrecommitWarning(row));
+        }
+    }
+    const decision = blockReasons.length > 0 ? "BLOCK" : warnings.length > 0 ? "WARN" : "OK";
+    const messages = [
+        ...blockReasons.map((reason) => `BLOCK: ${reason.message}`),
+        ...warnings.map((warning) => warning.message)
+    ];
+    return {
+        decision,
+        exit_code: decision === "BLOCK" ? 1 : 0,
+        block_reasons: blockReasons,
+        warnings,
+        messages
+    };
+}
+// ---------------------------------------------------------------------------
+// PR-summary formatter (spec 10.2 "textual summary"): a freshness status object
+// -> a human-readable block of counts + each SUSPECT/INVALID row with its
+// required action + the inferred Swift spans. Pure and deterministic.
+// ---------------------------------------------------------------------------
+export function formatFreshnessPrSummary(status) {
+    const lines = [];
+    lines.push(`USE-CASE FRESHNESS SUMMARY (policy: ${status.policy_mode})`);
+    const summary = status.summary;
+    lines.push(`fresh: ${summary.fresh}  suspect: ${summary.suspect}  unproven: ${summary.unproven}  ` +
+        `unbound: ${summary.unbound}  invalid: ${summary.invalid}  policy_blocked: ${summary.policy_blocked}`);
+    const invalidRows = status.rows.filter((row) => row.status === "INVALID");
+    lines.push("");
+    lines.push("INVALID rows:");
+    if (invalidRows.length === 0) {
+        lines.push("- (none)");
+    }
+    else {
+        for (const row of invalidRows) {
+            lines.push(`- ${row.row_id}  reason: ${firstReasonCode(row)}`);
+            lines.push(`  required action: ${defaultRequiredAction(row)}`);
+        }
+    }
+    const suspectRows = status.rows.filter((row) => row.status === "SUSPECT" || row.status === "UNPROVEN" || row.status === "UNBOUND");
+    lines.push("");
+    lines.push("SUSPECT / UNPROVEN / UNBOUND rows:");
+    if (suspectRows.length === 0) {
+        lines.push("- (none)");
+    }
+    else {
+        for (const row of suspectRows) {
+            lines.push(`- ${row.row_id}  status: ${row.status}  reason: ${firstReasonCode(row)}`);
+            lines.push(`  required action: ${defaultRequiredAction(row)}`);
+        }
+    }
+    // Inferred Swift spans (spec 8.2 / 10.2: CI must print inferred spans).
+    const inferred = status.rows.flatMap((row) => row.current_bindings
+        .filter((binding) => binding.extent_kind === "swift_func_inferred")
+        .map((binding) => ({ row_id: row.row_id, binding })));
+    if (inferred.length > 0) {
+        for (const { row_id, binding } of inferred) {
+            lines.push("");
+            lines.push("INFERRED SWIFT SPAN");
+            lines.push(`row: ${row_id}`);
+            lines.push(`binding: ${binding.binding_slug}`);
+            lines.push(`file: ${binding.file_path}`);
+            lines.push(`span: lines ${binding.span_start_line}-${binding.span_end_line}`);
+            lines.push(`span_sha256: ${binding.span_sha256}`);
+        }
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=precommit.js.map

package/packages/core/dist/markers/cli/precommit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"precommit.js","sourceRoot":"","sources":["../../../src/markers/cli/precommit.ts"],"names":[],"mappings":"AA+DA,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvF,SAAS,eAAe,CAAC,GAAoB;IAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAoB;IACjD,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,eAAe,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,KAAK,SAAS;QAC7B,CAAC,CAAC,iBAAiB,GAAG,CAAC,MAAM,EAAE;QAC/B,CAAC,CAAC,kBAAkB,GAAG,CAAC,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,UAAU,sBAAsB,CAAC,GAAoB;IACzD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG;QACd,gBAAgB,GAAG,CAAC,MAAM,EAAE;QAC5B,QAAQ,GAAG,CAAC,MAAM,EAAE;QACpB,WAAW,MAAM,EAAE;QACnB,oBAAoB,cAAc,EAAE;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAoC;QAChD,MAAM;QACN,eAAe,EAAE,cAAc;QAC/B,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAqB;IACnD,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,sEAAsE;IACtE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChD,YAAY,CAAC,IAAI,CAAC;oBAChB,MAAM,EAAE,iBAAiB;oBACzB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,oBAAoB,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,OAAO,EAAE;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC;gBAChB,MAAM,EAAE,iBAAiB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,6EAA6E;aACvF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAC/D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CACtC,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,YAAY,CAAC,IAAI,CAAC;oBAChB,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,yBAAyB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;iBAChE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC;gBAChB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,kEAAkE;aAC5E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC;gBAChB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,eAAe,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC,GAAG,CAAC,EAAE;aAC9D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,4EAA4E;YAC5E,qEAAqE;YACrE,YAAY,CAAC,IAAI,CAAC;gBAChB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EACL,2BAA2B,GAAG,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK;oBAChE,GAAG,qBAAqB,CAAC,GAAG,CAAC,EAAE;aAClC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GACZ,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,MAAM,QAAQ,GAAa;QACzB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3D,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;KAC9C,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,aAAa,EAAE,YAAY;QAC3B,QAAQ;QACR,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,0EAA0E;AAC1E,sEAAsE;AACtE,8EAA8E;AAC9E,MAAM,UAAU,wBAAwB,CAAC,MAAuB;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,KAAK,CAAC,IAAI,CACR,UAAU,OAAO,CAAC,KAAK,cAAc,OAAO,CAAC,OAAO,eAAe,OAAO,CAAC,QAAQ,IAAI;QACrF,YAAY,OAAO,CAAC,OAAO,cAAc,OAAO,CAAC,OAAO,qBAAqB,OAAO,CAAC,cAAc,EAAE,CACxG,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,aAAa,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,sBAAsB,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAC3F,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACjD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,aAAa,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,sBAAsB,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3C,GAAG,CAAC,gBAAgB;SACjB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,qBAAqB,CAAC;SAClE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/packages/core/dist/markers/cli/prove.d.ts

@@ -0,0 +1,69 @@
+import type { ResolvedWorkspaceContext } from "../../roots.js";
+import type { CommentPrefixConfig } from "../commentPrefix.js";
+import { type PemOrKeyObject, type PublicKeyResolver } from "../proofSignature.js";
+import type { CiAuthority } from "../ciAuthority.js";
+import type { GitRunner } from "../appendOnly.js";
+import { type MarkerFs } from "./io.js";
+import type { VerificationResultRecord } from "./verify.js";
+export declare const ALLOW_UNSAFE_VERIFICATION_ENV = "UCM_ALLOW_UNSAFE_VERIFICATION";
+export interface ProveSigningKey {
+    privateKey: PemOrKeyObject;
+    keyId: string;
+}
+export interface ProveProducerInfo {
+    id?: string;
+    version?: string;
+    ci_run_id?: string;
+    repo?: string;
+    commit?: string;
+}
+export interface ProveCommandOptions {
+    context: ResolvedWorkspaceContext;
+    productRoot: string;
+    bindingsPath: string;
+    evidencePath: string;
+    publicKeyResolver: PublicKeyResolver;
+    rowId?: string;
+    all?: boolean;
+    refresh?: boolean;
+    trustedCi?: boolean;
+    append?: boolean;
+    dryRun?: boolean;
+    verificationResults?: VerificationResultRecord[];
+    unsafeAssumeVerificationResult?: "pass";
+    signingKey?: ProveSigningKey;
+    producer?: ProveProducerInfo;
+    authority?: CiAuthority;
+    generatedAt: string;
+    idFactory?: () => string;
+    fs?: MarkerFs;
+    commentConfig?: CommentPrefixConfig;
+    baseRef?: string;
+    gitRunner?: GitRunner;
+    repoCwd?: string;
+}
+export type ProveRowStatus = "signed" | "candidate" | "skipped_unbound" | "skipped_fresh" | "failed";
+export interface ProveRowResult {
+    row_id: string;
+    status: ProveRowStatus;
+    reason: string | null;
+    message: string | null;
+    proof_event_appended: boolean;
+    event_id: string | null;
+    row_hash: string | null;
+    binding_set_hash: string | null;
+}
+export interface ProveCommandResult {
+    exit_code: number;
+    ok: boolean;
+    command: "prove";
+    trusted: boolean;
+    rows: ProveRowResult[];
+    proof_events_appended: number;
+    errors: Array<{
+        code: string;
+        message: string;
+    }>;
+}
+export declare function runProveCommand(options: ProveCommandOptions): ProveCommandResult;
+//# sourceMappingURL=prove.d.ts.map

package/packages/core/dist/markers/cli/prove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prove.d.ts","sourceRoot":"","sources":["../../../src/markers/cli/prove.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAoB/D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAiC,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAI5D,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,iBAAiB,CAAC;IAErC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,GAAG,CAAC,EAAE,OAAO,CAAC;IAEd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IAGjB,mBAAmB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAGjD,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAI7B,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,QAAQ,CAAC;AAEb,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IAEvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAyCD,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,CA6GhF"}